74 | 2023 Cal-Peculiarities ©2023 Seyfarth Shaw LLP www.seyfarth.com CCPA regulations provide guidance on implementation.105 Employers’ obligations under this legislation must be considered holistically with other obligations (e.g., the duty to protect personal information outlined in § 4.8.2). As noted above, effective on January 1, 2023, the California Privacy Rights Act (CPRA) amended the CCPA to eliminate the CCPA’s exemption for employee personal information. Under the CPRA amendments, businesses both within and outside of California that are covered106 by the legislation are now required to treat job applicants, employees, directors, officers, independent contractors, and other members of the workforce as "consumers" as defined in the CCPA.107 This legislation requires employers to provide comprehensive information to employees and others about all personal information handling practices; to facilitate the exercise of rights by such individuals to request certain specifics about the employer’s practices; to delete personal information; and to limit the use of certain types of information and for certain purposes (all of which will implicate the employer’s legitimate uses of such information for purposes outlined elsewhere in this book). Under the amended law, California consumers – now including applicants, employees, and independent contractors – have the right to (1) be provided notice prior to their data being collected; (2) ask a business to disclose what personal informationit has collected; (3) know what personal information is being sold or disclosed and to whom108; (4) request and receive a copy of all of the above information in a readily useable format; (5) correct inaccurate personal information109; (6) request that the company delete their personal information (the right to be forgotten)110;, (7) opt out of the sale of their personal information; (8) restrict the use of their “sensitive personal information” (if the purpose of the collection is to infer characteristics from the data);111 and (9) be free from retaliation for exercising any CCPA rights. These rights are addressed in more detail below. Notice Requirements Under the CCPA, covered businesses are required to notify “consumers” in advance of collection what categories of personal information the business will collect, for what purposes, whether the personal information has or will be shared (and the categories of third parties with whom it is shared), and what rights the consumers have with regard to such information, along with certain other specific requirements.112 Consumer Rights Consumers have the right to request disclosure of what personal information about them has been collected and how it is used or shared ("the right to know"), the right to correct inaccuracies, the right to request deletion (subject to certain exceptions), the right to opt out of sale or sharing of personal information, and the right to limit the use and disclosure of “sensitive personal information.”113 Sensitive Personal Information "Sensitive personal information” includes a consumer’s government identification, account log-in, financial accounts and card numbers and access credentials, geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, the contents of communications, genetic data, information concerning a consumer's health, sex life or sexual orientation, or biometric information processed for the purpose of uniquely identifying a consumer.114 Non-discrimination Consumers also have the right to not be discriminated against for exercising their CCPA rights.115 Third-party sharing and vendor management
RkJQdWJsaXNoZXIy OTkwMTQ4